Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Tooling] Use a trusted CI agent for pipelines that require push access #21028

Merged
merged 8 commits into from
Jul 4, 2024
Merged

[Tooling] Use a trusted CI agent for pipelines that require push access #21028

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c94c0a1
Use a bot user in a trusted agent for pipelines that require git push…
iangmaia Jul 1, 2024
afe335d
Replace plugin declaration to use shared var instead
iangmaia Jul 2, 2024
2597b0d
[TO REVERT] Add temp lane to test git push permissions
iangmaia Jul 2, 2024
ab7a38e
[TO REVERT] Use bot for test git operation
iangmaia Jul 2, 2024
06711d0
Bump version number
wpmobilebot Jul 2, 2024
2899ec5
Revert commits 2597b0df0d9b28c2443bcb4155450c3f798450f0, ab7a38e9168b…
iangmaia Jul 2, 2024
db4b88f
Inline the `use-bot-for-git` script sourcing
iangmaia Jul 4, 2024
59a7598
Improve logging for release pipelines
iangmaia Jul 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions .buildkite/beta-builds.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,6 @@
# This pipeline is meant to be run via the Buildkite API, and is
# only used for beta builds

# Nodes with values to reuse in the pipeline.
common_params:
# Common plugin settings to use with the `plugins` key.
- &common_plugins
- automattic/a8c-ci-toolkit#3.4.2

agents:
queue: "android"

Expand All @@ -20,7 +14,7 @@ steps:
- label: "Gradle Wrapper Validation"
command: |
validate_gradle_wrapper
plugins: *common_plugins
plugins: [$CI_TOOLKIT]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice tidy up.

Have you considered:

Suggested change
plugins: [$CI_TOOLKIT]
plugins: $CI_TOOLKIT

I never tried it but I assume the Buildkite parser would be smart enough to allow a scalar value here and convert it to a sequence internally.

However, maybe we're better off leaving the [ ] so the diff when adding a new plugin will be smaller 🤷‍♂️

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I think that Buildkite would allow a single value in an attribute expecting an array (and would wrap it in an array automatically for us) and thus allow such a syntax… personally I prefer to be explicit in it being an array and thus keep the […] syntax.


# Wait for Gradle Wrapper to be validated before running any other jobs
- wait
Expand Down Expand Up @@ -53,15 +47,15 @@ steps:
key: wpbuild
command: ".buildkite/commands/beta-build.sh wordpress"
depends_on: wplint
plugins: *common_plugins
plugins: [$CI_TOOLKIT]
notify:
- slack: "#build-and-ship"

- label: ":jetpack: :android: Beta Build"
key: jpbuild
command: ".buildkite/commands/beta-build.sh jetpack"
depends_on: jplint
plugins: *common_plugins
plugins: [$CI_TOOLKIT]
notify:
- slack: "#build-and-ship"

Expand All @@ -73,4 +67,4 @@ steps:
- wpbuild
- jpbuild
command: ".buildkite/commands/create-github-release.sh"
plugins: *common_plugins
plugins: [$CI_TOOLKIT]
6 changes: 3 additions & 3 deletions .buildkite/code-freeze.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
---

agents:
queue: "android"

steps:
- label: "Code Freeze"
plugins: [$CI_TOOLKIT]
command: |
.buildkite/commands/configure-git-for-release-management.sh
source .buildkite/commands/configure-git-for-release-management.sh
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with @mokagio that we might as well remove configure-git-for-release-management.sh at that point and call source use-bot-for-git directly from there.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated on db4b88f (plus added logging on 59a7598)


install_gems

bundle exec fastlane code_freeze skip_confirm:true
agents:
queue: "tumblr-metal"
15 changes: 8 additions & 7 deletions .buildkite/commands/configure-git-for-release-management.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
#!/bin/bash -eu

# Git command line client is not configured in Buildkite. Temporarily, we configure it in each step.
# Later on, we should be able to configure the agent instead.
curl -L https://api.github.com/meta | jq -r '.ssh_keys | .[]' | sed -e 's/^/github.com /' >> ~/.ssh/known_hosts
git config --global user.email "mobile+wpmobilebot@automattic.com"
git config --global user.name "Automattic Release Bot"
# This script needs to be source'd as use-bot-for-git exports a variable and this needs to be visible outside
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
echo "This script must be 'source'd (instead of being called directly as an executable) to work properly"
exit 1
fi
iangmaia marked this conversation as resolved.
Show resolved Hide resolved

# Buildkite is currently using the https url to checkout. We need to override it to be able to use the deploy key.
git remote set-url origin git@github.com:wordpress-mobile/WordPress-Android.git
echo '--- :robot_face: Use bot for git operations'
# shellcheck disable=SC1091
source use-bot-for-git
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you considered removing the script and inlining the source use-bot-for-git call in the pipeline command node / script called by the command node?

As far as I can see, the only additional operation in this script is the echo which we could either move in the command too, or add in the use-bot-for-git implementation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good suggestion -- this script previously did more but it makes sense to inline the operations now -- and tbh, I think it's a lot better with less indirections.
Updated on db4b88f (plus added logging on 59a7598)

6 changes: 3 additions & 3 deletions .buildkite/complete-code-freeze.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
---

agents:
queue: "android"

steps:
- label: "Complete Code Freeze"
plugins: [$CI_TOOLKIT]
command: |
.buildkite/commands/configure-git-for-release-management.sh
source .buildkite/commands/configure-git-for-release-management.sh
.buildkite/commands/checkout-release-branch.sh

install_gems

bundle exec fastlane complete_code_freeze skip_confirm:true
agents:
queue: "tumblr-metal"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this has been discussed elsewhere, in which case apologies for the redundancy, but it would be nice for this to eventually be an agent that doesn't have Tumblr in the name 😄

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, whenever I type tumblr-metal I think the same. This is inside Tumblr's DCA, and that's the reason.
But given it is being used for all sorts of things non-Tumblr related, we could name the queue a bit differently.

6 changes: 3 additions & 3 deletions .buildkite/finalize-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
---

agents:
queue: "android"

steps:
- label: "Finalize release"
plugins: [$CI_TOOLKIT]
command: |
.buildkite/commands/configure-git-for-release-management.sh
source .buildkite/commands/configure-git-for-release-management.sh
.buildkite/commands/checkout-release-branch.sh

install_gems

cp gradle.properties-example gradle.properties

bundle exec fastlane finalize_release skip_confirm:true
agents:
queue: "tumblr-metal"
6 changes: 3 additions & 3 deletions .buildkite/new-beta-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
---

agents:
queue: "android"

steps:
- label: "New Beta Release"
plugins: [$CI_TOOLKIT]
command: |
.buildkite/commands/configure-git-for-release-management.sh
source .buildkite/commands/configure-git-for-release-management.sh

install_gems

cp gradle.properties-example gradle.properties

bundle exec fastlane new_beta_release skip_confirm:true
agents:
queue: "tumblr-metal"
6 changes: 3 additions & 3 deletions .buildkite/update-release-notes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
---

agents:
queue: "android"

steps:
- label: "Update release notes"
plugins: [$CI_TOOLKIT]
command: |
.buildkite/commands/configure-git-for-release-management.sh
source .buildkite/commands/configure-git-for-release-management.sh
.buildkite/commands/checkout-editorial-branch.sh

install_gems

bundle exec fastlane update_appstore_strings version:${RELEASE_VERSION}
agents:
queue: "tumblr-metal"
Loading